# How to collect from two instances to logstash instance using filebeat

**URL:** <https://discuss.elastic.co/t/how-to-collect-from-two-instances-to-logstash-instance-using-filebeat/36689>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [December 9, 2015, 5:47am UTC](https://discuss.elastic.co/t/how-to-collect-from-two-instances-to-logstash-instance-using-filebeat/36689 "2015-12-09T05:47:08Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![kartheek91](https://avatars.discourse-cdn.com/v4/letter/k/cc9497/32.png) [@kartheek91](https://discuss.elastic.co/u/kartheek91)\
**Post date:** [December 9, 2015, 5:47am UTC](https://discuss.elastic.co/t/how-to-collect-from-two-instances-to-logstash-instance-using-filebeat/36689/1 "2015-12-09T05:47:09Z")

</div>

Can you please guide me how to collect logs from two seperate instances to logstash.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [December 9, 2015, 6:22am UTC](https://discuss.elastic.co/t/how-to-collect-from-two-instances-to-logstash-instance-using-filebeat/36689/2 "2015-12-09T06:22:15Z")

</div>

Have you followed the [Filebeat Getting Started Guide](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-getting-started.html) and configured the [Logstash output](https://www.elastic.co/guide/en/beats/libbeat/1.0.0/configuration.html#logstash-output)? Is there any particular step that is causing problems?

---

<div class="post-metadata">

**Author:** ![kartheek91](https://avatars.discourse-cdn.com/v4/letter/k/cc9497/32.png) [@kartheek91](https://discuss.elastic.co/u/kartheek91)\
**Post date:** [December 9, 2015, 6:29am UTC](https://discuss.elastic.co/t/how-to-collect-from-two-instances-to-logstash-instance-using-filebeat/36689/3 "2015-12-09T06:29:52Z")

</div>

Yes I followed but the logs are not coming differnet instances to logstash.

---

<div class="post-metadata">

**Author:** ![kartheek91](https://avatars.discourse-cdn.com/v4/letter/k/cc9497/32.png) [@kartheek91](https://discuss.elastic.co/u/kartheek91)\
**Post date:** [December 9, 2015, 6:30am UTC](https://discuss.elastic.co/t/how-to-collect-from-two-instances-to-logstash-instance-using-filebeat/36689/4 "2015-12-09T06:30:34Z")

</div>

can you have provide me any confiuration to get the logs from different instances to logstash instance.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [December 9, 2015, 6:39am UTC](https://discuss.elastic.co/t/how-to-collect-from-two-instances-to-logstash-instance-using-filebeat/36689/5 "2015-12-09T06:39:57Z")

</div>

What does your Filebeat configuration(s) look like? What does your Logstash configuration look like? Have you tried using the stdout output in Logstash to verify whether anything is coming into Logstash? Do you see any errors in the logs?

---

<div class="post-metadata">

**Author:** ![kartheek91](https://avatars.discourse-cdn.com/v4/letter/k/cc9497/32.png) [@kartheek91](https://discuss.elastic.co/u/kartheek91)\
**Post date:** [December 9, 2015, 6:41am UTC](https://discuss.elastic.co/t/how-to-collect-from-two-instances-to-logstash-instance-using-filebeat/36689/6 "2015-12-09T06:41:39Z")

</div>

sorry

---

<div class="post-metadata">

**Author:** ![kartheek91](https://avatars.discourse-cdn.com/v4/letter/k/cc9497/32.png) [@kartheek91](https://discuss.elastic.co/u/kartheek91)\
**Post date:** [December 9, 2015, 6:42am UTC](https://discuss.elastic.co/t/how-to-collect-from-two-instances-to-logstash-instance-using-filebeat/36689/7 "2015-12-09T06:42:20Z")

</div>

This is in the instance where we want to collect logs file beat input plugin was installed and it cinfiguration

---

<div class="post-metadata">

**Author:** ![kartheek91](https://avatars.discourse-cdn.com/v4/letter/k/cc9497/32.png) [@kartheek91](https://discuss.elastic.co/u/kartheek91)\
**Post date:** [December 9, 2015, 6:43am UTC](https://discuss.elastic.co/t/how-to-collect-from-two-instances-to-logstash-instance-using-filebeat/36689/8 "2015-12-09T06:43:07Z")

</div>

ssoory

---

<div class="post-metadata">

**Author:** ![kartheek91](https://avatars.discourse-cdn.com/v4/letter/k/cc9497/32.png) [@kartheek91](https://discuss.elastic.co/u/kartheek91)\
**Post date:** [December 9, 2015, 6:43am UTC](https://discuss.elastic.co/t/how-to-collect-from-two-instances-to-logstash-instance-using-filebeat/36689/9 "2015-12-09T06:43:47Z")

</div>

This is the config file in logstash where filebeat was installed

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [December 9, 2015, 7:03am UTC](https://discuss.elastic.co/t/how-to-collect-from-two-instances-to-logstash-instance-using-filebeat/36689/10 "2015-12-09T07:03:18Z")

</div>

I would also recommend providing a proper title for the post.

---

<div class="post-metadata">

**Author:** ![kartheek91](https://avatars.discourse-cdn.com/v4/letter/k/cc9497/32.png) [@kartheek91](https://discuss.elastic.co/u/kartheek91)\
**Post date:** [December 9, 2015, 7:10am UTC](https://discuss.elastic.co/t/how-to-collect-from-two-instances-to-logstash-instance-using-filebeat/36689/11 "2015-12-09T07:10:42Z")

</div>

once see know

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [December 9, 2015, 8:15am UTC](https://discuss.elastic.co/t/how-to-collect-from-two-instances-to-logstash-instance-using-filebeat/36689/12 "2015-12-09T08:15:08Z")

</div>

In order to identify what is going wrong, please temporarily replace the elasticsearch output with stdout. This makes it easy to see what data is actually received. Then verify that you can telnet to the Logstash input port from the machines where Filbert is installed. Do you see any connections established to Logstash? Does the Filebeat configuration match any log files on the server?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 9:57pm UTC](https://discuss.elastic.co/t/how-to-collect-from-two-instances-to-logstash-instance-using-filebeat/36689/13 "2017-07-05T21:57:35Z")

</div>


